Security Policy

This Security Policy describes how Weathertop Studios thinks about protecting MiTRYBE accounts, preference maps, and service integrity. It is written in plain language for an early Florida-first product—not as security theater and not as a penetration-test report. Our product thesis is Don't guess. Ask. Security follows a related idea: do not invent reassurance. We explain what we actually do, what you must still do, and where residual risk remains.

Read with the Accounts Policy, Privacy Policy, and Cookies & Local Storage policy. Report suspected compromise through Contact Us.

1. Purpose

Security measures exist to protect authentication, reduce unauthorized access to preference data, keep the service available for legitimate Florida users, and support trustworthy unlocks and recommendations. They also exist to protect Weathertop Studios' ability to operate MiTRYBE without turning the preference map into an easy target for scraping or account takeover.

This document sets expectations for users, describes high-level practices, and outlines incident response posture. It is not an invitation to test our systems without authorization. Unauthorized probing may violate the Terms of Use and law.

2. Scope

This policy covers MiTRYBE web surfaces operated by Weathertop Studios, Firebase Authentication-based sign-in, Firestore-backed profiles where enabled, application hosting configurations we control, and operator access to those systems. It covers local browser storage such as mitrybe-profile-v2 only to the extent that we design the client to store working preference state; physical control of your device remains yours.

Third-party venues mentioned in seed recommendations, Google's underlying cloud security beyond our configuration, your email provider, and your endpoint devices are outside full Weathertop Studios control. We rely on reputable providers and ask you to harden the fronts doors you own.

3. Definitions

"Credentials" means passwords, session tokens, OAuth grants, and recovery factors."Firebase Authentication" means Google's authentication service used to verify identity for MiTRYBE."Firestore" means the Google Cloud database that may store account-linked profile and progress documents."Incident" means a suspected or confirmed event that jeopardizes confidentiality, integrity, or availability of MiTRYBE systems or user data. "Operator" means an authorized Weathertop Studios person with administrative access.

4. Authentication and sessions

MiTRYBE uses Firebase Authentication rather than custom password storage on marketing or app surfaces we build ourselves. Depending on configuration, you may sign in with email and password or Google. When you use Google, Weathertop Studios does not receive your Google password. Firebase issues tokens that establish sessions. Tokens can expire, be refreshed, or be revoked.

You are responsible for unique passwords, for protecting email inbox access used in recovery, and for signing out on shared devices. If multi-factor authentication becomes available through Firebase or Google account settings, enable it. Account takeover usually starts with reused passwords or phishing—not with exotic attacks on our question cards.

Weathertop Studios may invalidate sessions when we detect abuse, credential stuffing patterns, or confirmed compromise. We may require password resets. Support will not ask you for your password by unsolicited email.

5. Preference data and access controls

Preference maps may live in browser local storage and, when you are signed in, in Firestore documents associated with your Firebase UID. Client security rules are configured with the intent that ordinary users can read and write only their own documents. Operators may access data for support, security, integrity, and legal compliance under internal least-privilege practices appropriate to an early team.

Local storage is only as safe as your device user accounts and browser profile. Shared family computers, workplace devices, and unattended sessions can expose mitrybe-profile-v2 contents to whoever uses the browser next. Clear site data or sign out when appropriate. See the Cookies policy for storage details.

We do not need a surveillance clickstream dossier to personalize MiTRYBE; the map comes from answers you gave. That reduces some classes of sensitive inference risk, but answered preference data can still be personal. Protect the account that guards the cloud copy.

6. Transport, hosting, and providers

MiTRYBE is served over HTTPS so traffic between your browser and our hosting endpoints is encrypted in transit under normal configurations. We rely on Google Firebase / Google Cloud and related hosting vendors for substantial infrastructure security capabilities. Weathertop Studios configures projects, authentication providers, and database rules; Google operates the underlying platforms under their terms and security programs.

No provider relationship eliminates all risk. Misconfiguration, dependency bugs, and novel attacks remain possible. We monitor for obvious breakage and abuse as capacity allows. We prioritize fixes that protect authentication and private preference documents over cosmetic issues.

7. Application integrity and abuse resistance

Weathertop Studios may rate-limit expensive endpoints, block abusive IP patterns, require email verification for sensitive actions, and disable accounts that automate answering or scraping at harmful volumes. Feature unlocks that depend on answered questions are product logic; attempting to bypass them through bulk accounts or instrumented clients may result in enforcement under Accounts and Terms policies.

We do not claim bug-free software. Early experimental fields ship with imperfect edges. Report vulnerabilities responsibly through security@mitrybe.com if that address is monitored, or via /contact with a clear subject line. Include steps to reproduce at a high level without including exploit payloads aimed at harming other users.

8. Operator and administrative practices

Access to production Firebase projects and related consoles should be limited to people who need it. Operators should use strong authentication on their own accounts. Weathertop Studios will avoid sharing production credentials through insecure channels. When an operator leaves the relevant role, access should be revoked promptly as part of ordinary offboarding.

Support staff may need to view account metadata to help with login issues. They should not demand passwords. Users should be skeptical of anyone claiming to be MiTRYBE support outside official contact paths listed on the site.

9. Incident response posture

When Weathertop Studios learns of a suspected incident, we aim to: contain the issue (for example, revoke sessions, tighten rules, disable abusive pathways); assess scope (what systems and which users may be affected); remediate (patch configuration or code, rotate secrets if needed); and communicate when notice is legally required or clearly warranted for user self-protection. Timelines depend on severity and on facts—not on a theatrical countdown clock.

If your account is affected, we may email the address on the Firebase record or post a notice on mitrybe.com. You should also tell us if you see unauthorized map changes, unexpected password-reset messages you did not request, or sign-in alerts from Google you do not recognize.

Weathertop Studios may cooperate with law enforcement when legally compelled or when serious harm is involved. Privacy Policy constraints still guide what we disclose.

10. Your security responsibilities

• Use a unique password and protect your email recovery path.
• Enable multi-factor authentication on Google if you use Google sign-in.
• Sign out on shared or public devices; clear local site data if needed.
• Ignore phishing that asks for MiTRYBE passwords or secret codes.
• Keep your browser and operating system reasonably updated.
• Report takeover symptoms quickly via Contact Us.

Security is shared. Weathertop Studios can configure Firebase well and still cannot stop you from reusing "Florida2024!" on every site. The preference map is worth a better password.

11. Limitations and residual risk

No method of transmission or storage is perfectly secure. Early products have smaller teams and fewer automated controls than mature platforms. Local-only profiles can be copied from a device by anyone with access. Third-party outages at Google can take MiTRYBE offline without any bug in our question UI. Seed recommendation outbound links leave our security boundary immediately.

This policy does not create a warranty of uninterrupted or error-free service beyond what the Terms of Use already state. It does not promise SOC reports, bug bounties, or insured cyber coverage unless Weathertop Studios separately publishes those commitments.

12. Children and sensitive situations

MiTRYBE is not directed at children under 13. If a minor's data was collected in error, contact privacy@mitrybe.com. If you believe a child is being exploited through any Weathertop Studios property, contact us and appropriate authorities. Community Standards prohibit exploitation; security systems support that ban where technically feasible.

13. Florida-first operations note

Weathertop Studios operates MiTRYBE with Florida as the first user field. Infrastructure remains U.S.-oriented cloud services. Weather events in Florida can affect users' ability to reach the service even when cloud regions elsewhere remain healthy. Plan offline judgment for travel and safety regardless of whether recommendation cards load.

14. Changes and contact

We may update this Security Policy as practices mature. The "Last updated" date will change when we post revisions. Continued use after updates constitutes acceptance of the described posture where permitted by law. Material user-facing security changes may also appear in Accounts or Privacy policies.

Security reports and compromise notices: /contact, support@mitrybe.com, or privacy@mitrybe.com for data-handling questions. Related reading: all policies, /difference.